@tatchi-xyz/sdk 0.31.0 → 0.32.0

package/dist/esm/react/src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/transactions.js

@@ -26,91 +26,91 @@ async function handleTransactionSigningFlow(ctx, request, worker, opts) {
 		transactionSummary
 	});
 	const nearAccountId = getNearAccountId(request);
-	const signingAuthMode = getSigningAuthMode(request);
-	const usesNeeded = getTxCount(request);
-	const vrfIntentDigestB64u = request.type === SecureConfirmationType.SIGN_TRANSACTION ? getIntentDigest(request) : request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE ? await computeUiIntentDigestFromNep413({
-		nearAccountId,
-		recipient: request.payload.recipient,
-		message: request.payload.message
-	}) : void 0;
-	const sessionPolicyDigest32 = request.payload.sessionPolicyDigest32;
-	const nearRpc = await adapters.near.fetchNearContext({
-		nearAccountId,
-		txCount: usesNeeded,
-		reserveNonces: true
-	});
-	if (!nearRpc.transactionContext) {
-		console.error("[SigningFlow] fetchNearContext failed", {
-			error: nearRpc.error,
-			details: nearRpc.details
-		});
-		return session.confirmAndCloseModal({
-			requestId: request.requestId,
-			intentDigest: getIntentDigest(request),
-			confirmed: false,
-			error: nearRpc.details ? `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}` : ERROR_MESSAGES.nearRpcFailed
+	try {
+		const signingAuthMode = getSigningAuthMode(request);
+		const usesNeeded = getTxCount(request);
+		const vrfIntentDigestB64u = request.type === SecureConfirmationType.SIGN_TRANSACTION ? getIntentDigest(request) : request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE ? await computeUiIntentDigestFromNep413({
+			nearAccountId,
+			recipient: request.payload.recipient,
+			message: request.payload.message
+		}) : void 0;
+		const sessionPolicyDigest32 = request.payload.sessionPolicyDigest32;
+		const nearRpc = await adapters.near.fetchNearContext({
+			nearAccountId,
+			txCount: usesNeeded,
+			reserveNonces: true
 		});
-	}
-	session.setReservedNonces(nearRpc.reservedNonces);
-	let transactionContext = nearRpc.transactionContext;
-	const rpId = adapters.vrf.getRpId();
-	let uiVrfChallenge;
-	let uiVrfChallengeForUi = rpId ? {
-		userId: nearAccountId,
-		rpId,
-		blockHeight: transactionContext.txBlockHeight,
-		blockHash: transactionContext.txBlockHash
-	} : void 0;
-	if (signingAuthMode === "webauthn") {
-		uiVrfChallenge = await adapters.vrf.generateVrfChallengeForSession({
-			userId: nearAccountId,
-			rpId,
-			blockHeight: transactionContext.txBlockHeight,
-			blockHash: transactionContext.txBlockHash,
-			...vrfIntentDigestB64u ? { intentDigest: vrfIntentDigestB64u } : {},
-			...sessionPolicyDigest32 ? { sessionPolicyDigest32 } : {}
-		}, request.requestId);
-		uiVrfChallengeForUi = uiVrfChallenge;
-	}
-	const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallengeForUi });
-	if (!confirmed) return session.confirmAndCloseModal({
-		requestId: request.requestId,
-		intentDigest: getIntentDigest(request),
-		confirmed: false,
-		error: uiError
-	});
-	if (signingAuthMode === "warmSession") {
-		try {
-			await adapters.vrf.dispenseSessionKey({
-				sessionId: request.requestId,
-				uses: usesNeeded
+		if (!nearRpc.transactionContext) {
+			console.error("[SigningFlow] fetchNearContext failed", {
+				error: nearRpc.error,
+				details: nearRpc.details
 			});
-		} catch (err) {
-			const msg = String(toError(err)?.message || err || "");
 			return session.confirmAndCloseModal({
 				requestId: request.requestId,
 				intentDigest: getIntentDigest(request),
 				confirmed: false,
-				error: msg || "Failed to dispense warm session key"
+				error: nearRpc.details ? `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}` : ERROR_MESSAGES.nearRpcFailed
 			});
 		}
-		session.confirmAndCloseModal({
+		session.setReservedNonces(nearRpc.reservedNonces);
+		let transactionContext = nearRpc.transactionContext;
+		const rpId = adapters.vrf.getRpId();
+		let uiVrfChallenge;
+		let uiVrfChallengeForUi = rpId ? {
+			userId: nearAccountId,
+			rpId,
+			blockHeight: transactionContext.txBlockHeight,
+			blockHash: transactionContext.txBlockHash
+		} : void 0;
+		if (signingAuthMode === "webauthn") {
+			uiVrfChallenge = await adapters.vrf.generateVrfChallengeForSession({
+				userId: nearAccountId,
+				rpId,
+				blockHeight: transactionContext.txBlockHeight,
+				blockHash: transactionContext.txBlockHash,
+				...vrfIntentDigestB64u ? { intentDigest: vrfIntentDigestB64u } : {},
+				...sessionPolicyDigest32 ? { sessionPolicyDigest32 } : {}
+			}, request.requestId);
+			uiVrfChallengeForUi = uiVrfChallenge;
+		}
+		const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallengeForUi });
+		if (!confirmed) return session.confirmAndCloseModal({
 			requestId: request.requestId,
 			intentDigest: getIntentDigest(request),
-			confirmed: true,
-			transactionContext
+			confirmed: false,
+			error: uiError
 		});
-		return;
-	}
-	try {
-		const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);
-		uiVrfChallenge = refreshed.vrfChallenge;
-		transactionContext = refreshed.transactionContext;
-		session.updateUI({ vrfChallenge: uiVrfChallenge });
-	} catch (e) {
-		console.debug("[SigningFlow] VRF JIT refresh skipped", e);
-	}
-	try {
+		if (signingAuthMode === "warmSession") {
+			try {
+				await adapters.vrf.dispenseSessionKey({
+					sessionId: request.requestId,
+					uses: usesNeeded
+				});
+			} catch (err) {
+				const msg = String(toError(err)?.message || err || "");
+				return session.confirmAndCloseModal({
+					requestId: request.requestId,
+					intentDigest: getIntentDigest(request),
+					confirmed: false,
+					error: msg || "Failed to dispense warm session key"
+				});
+			}
+			session.confirmAndCloseModal({
+				requestId: request.requestId,
+				intentDigest: getIntentDigest(request),
+				confirmed: true,
+				transactionContext
+			});
+			return;
+		}
+		try {
+			const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);
+			uiVrfChallenge = refreshed.vrfChallenge;
+			transactionContext = refreshed.transactionContext;
+			session.updateUI({ vrfChallenge: uiVrfChallenge });
+		} catch (e) {
+			console.debug("[SigningFlow] VRF JIT refresh skipped", e);
+		}
 		if (!uiVrfChallenge) throw new Error("Missing vrfChallenge for WebAuthn signing flow");
 		const serializedCredential = await adapters.webauthn.collectAuthenticationCredentialWithPRF({
 			nearAccountId,
@@ -158,7 +158,6 @@ async function handleTransactionSigningFlow(ctx, request, worker, opts) {
 	} catch (err) {
 		const cancelled = isUserCancelledSecureConfirm(err);
 		const msg = String(toError(err)?.message || err || "");
-		if (/Missing PRF result/i.test(msg) || /Missing PRF results/i.test(msg)) return session.cleanupAndRethrow(err);
 		if (cancelled) window.parent?.postMessage({ type: "WALLET_UI_CLOSED" }, "*");
 		const isWrongPasskeyError = /multiple passkeys \(devicenumbers\) for account/i.test(msg);
 		return session.confirmAndCloseModal({

package/dist/esm/react/src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/transactions.js.map

@@ -1 +1 @@
-{"version":3,"file":"transactions.js","names":["transactionContext: TransactionContext","uiVrfChallenge: VRFChallenge | undefined","uiVrfChallengeForUi: Partial<VRFChallenge> | undefined","err: unknown","contractId: string | undefined","nearRpcUrl: string | undefined"],"sources":["../../../../../../../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/transactions.ts"],"sourcesContent":["import type { VrfWorkerManagerContext } from '../../';\nimport type { ConfirmationConfig } from '../../../../types/signer-worker';\nimport {\n  SecureConfirmationType,\n  TransactionSummary,\n  SigningSecureConfirmRequest,\n  SigningAuthMode,\n} from '../types';\nimport { VRFChallenge, TransactionContext } from '../../../../types';\nimport {\n  getNearAccountId,\n  getIntentDigest,\n  getTxCount,\n  isUserCancelledSecureConfirm,\n  ERROR_MESSAGES,\n  getSignTransactionPayload,\n} from './index';\nimport { toAccountId } from '../../../../types/accountIds';\nimport { getLastLoggedInDeviceNumber } from '../../../SignerWorkerManager/getDeviceNumber';\nimport { toError } from '../../../../../utils/errors';\nimport { PASSKEY_MANAGER_DEFAULT_CONFIGS } from '../../../../defaultConfigs';\nimport { createConfirmSession } from '../adapters/session';\nimport { createConfirmTxFlowAdapters } from '../adapters/createAdapters';\nimport { computeUiIntentDigestFromNep413 } from '../../../../digests/intentDigest';\n\nfunction getSigningAuthMode(request: SigningSecureConfirmRequest): SigningAuthMode {\n  if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {\n    return getSignTransactionPayload(request).signingAuthMode ?? 'webauthn';\n  }\n  if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) {\n    return request.payload.signingAuthMode ?? 'webauthn';\n  }\n  return 'webauthn';\n}\n\nexport async function handleTransactionSigningFlow(\n  ctx: VrfWorkerManagerContext,\n  request: SigningSecureConfirmRequest,\n  worker: Worker,\n  opts: { confirmationConfig: ConfirmationConfig; transactionSummary: TransactionSummary },\n): Promise<void> {\n  const { confirmationConfig, transactionSummary } = opts;\n  const adapters = createConfirmTxFlowAdapters(ctx);\n  const session = createConfirmSession({\n    adapters,\n    worker,\n    request,\n    confirmationConfig,\n    transactionSummary,\n  });\n  const nearAccountId = getNearAccountId(request);\n  const signingAuthMode = getSigningAuthMode(request);\n  const usesNeeded = getTxCount(request);\n  const vrfIntentDigestB64u = request.type === SecureConfirmationType.SIGN_TRANSACTION\n    ? getIntentDigest(request)\n    : request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE\n      ? await computeUiIntentDigestFromNep413({\n        nearAccountId,\n        recipient: request.payload.recipient,\n        message: request.payload.message,\n      })\n      : undefined;\n  const sessionPolicyDigest32 = request.payload.sessionPolicyDigest32;\n\n  // 1) NEAR context + nonce reservation\n  const nearRpc = await adapters.near.fetchNearContext({ nearAccountId, txCount: usesNeeded, reserveNonces: true });\n  if (!nearRpc.transactionContext) {\n    // eslint-disable-next-line no-console\n    console.error('[SigningFlow] fetchNearContext failed', { error: nearRpc.error, details: nearRpc.details });\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: nearRpc.details ? `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}` : ERROR_MESSAGES.nearRpcFailed,\n    });\n  }\n  session.setReservedNonces(nearRpc.reservedNonces);\n  let transactionContext: TransactionContext = nearRpc.transactionContext;\n\n  // 2) Security context shown in the confirmer (rpId + block height).\n  // For warmSession signing we still want to show this context even though\n  // we won't collect a WebAuthn credential.\n  const rpId = adapters.vrf.getRpId();\n  let uiVrfChallenge: VRFChallenge | undefined;\n  let uiVrfChallengeForUi: Partial<VRFChallenge> | undefined = rpId\n    ? {\n        userId: nearAccountId,\n        rpId,\n        blockHeight: transactionContext.txBlockHeight,\n        blockHash: transactionContext.txBlockHash,\n      }\n    : undefined;\n\n  // Initial VRF challenge (only needed for WebAuthn credential collection)\n  if (signingAuthMode === 'webauthn') {\n    uiVrfChallenge = await adapters.vrf.generateVrfChallengeForSession(\n      {\n        userId: nearAccountId,\n        rpId,\n        blockHeight: transactionContext.txBlockHeight,\n        blockHash: transactionContext.txBlockHash,\n        ...(vrfIntentDigestB64u ? { intentDigest: vrfIntentDigestB64u } : {}),\n        ...(sessionPolicyDigest32 ? { sessionPolicyDigest32 } : {}),\n      },\n      request.requestId,\n    );\n    uiVrfChallengeForUi = uiVrfChallenge;\n  }\n\n  // 3) UI confirm\n  const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallengeForUi });\n  if (!confirmed) {\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: uiError,\n    });\n  }\n\n  // 4) Warm session: dispense WrapKeySeed and skip WebAuthn\n  if (signingAuthMode === 'warmSession') {\n    try {\n      await adapters.vrf.dispenseSessionKey({ sessionId: request.requestId, uses: usesNeeded });\n    } catch (err: unknown) {\n      const msg = String((toError(err))?.message || err || '');\n      return session.confirmAndCloseModal({\n        requestId: request.requestId,\n        intentDigest: getIntentDigest(request),\n        confirmed: false,\n        error: msg || 'Failed to dispense warm session key',\n      });\n    }\n\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      transactionContext,\n    });\n    return;\n  }\n\n  // 5) JIT refresh VRF + ctx (best-effort)\n  try {\n    const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);\n    uiVrfChallenge = refreshed.vrfChallenge;\n    transactionContext = refreshed.transactionContext;\n    session.updateUI({ vrfChallenge: uiVrfChallenge });\n  } catch (e) {\n    console.debug('[SigningFlow] VRF JIT refresh skipped', e);\n  }\n\n  // 6) Collect authentication credential\n  try {\n    if (!uiVrfChallenge) {\n      throw new Error('Missing vrfChallenge for WebAuthn signing flow');\n    }\n    const serializedCredential = await adapters.webauthn.collectAuthenticationCredentialWithPRF({\n      nearAccountId,\n      vrfChallenge: uiVrfChallenge,\n    });\n\n    // 5c) Derive WrapKeySeed inside the VRF worker and deliver it to the signer worker via\n    // the reserved WrapKeySeed MessagePort. Main thread only sees wrapKeySalt metadata.\n    let contractId: string | undefined;\n    let nearRpcUrl: string | undefined;\n    try {\n      // Ensure VRF session is active and bound to the same account we are signing for.\n      const vrfStatus = await adapters.vrf.checkVrfStatus();\n      if (!vrfStatus.active) {\n        throw new Error('VRF keypair not active in memory. VRF session may have expired or was not properly initialized. Please refresh and try again.');\n      }\n      if (!vrfStatus.nearAccountId || String(vrfStatus.nearAccountId) !== String(toAccountId(nearAccountId))) {\n        throw new Error('VRF session is active but bound to a different account than the one being signed. Please log in again on this device.');\n      }\n\n      const deviceNumber = await getLastLoggedInDeviceNumber(toAccountId(nearAccountId), ctx.indexedDB.clientDB);\n      const keyMaterial = await ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber);\n      if (!keyMaterial) {\n        throw new Error(`No key material found for account ${nearAccountId} device ${deviceNumber}`);\n      }\n      const wrapKeySalt = keyMaterial.wrapKeySalt;\n      if (!wrapKeySalt) {\n        throw new Error('Missing wrapKeySalt in vault; re-register to upgrade vault format.');\n      }\n\n      // Extract contract verification context when available.\n      // - SIGN_TRANSACTION: use per-request rpcCall (already normalized by caller).\n      // - SIGN_NEP413_MESSAGE: allow per-request override; fall back to PASSKEY_MANAGER_DEFAULT_CONFIGS.\n      if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {\n        const payload = getSignTransactionPayload(request);\n        contractId = payload?.rpcCall?.contractId;\n        nearRpcUrl = payload?.rpcCall?.nearRpcUrl;\n      } else if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) {\n        const payload = request.payload;\n        contractId = payload.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId;\n        nearRpcUrl = payload.nearRpcUrl || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl;\n      }\n\n      await adapters.vrf.mintSessionKeysAndSendToSigner({\n        sessionId: request.requestId,\n        wrapKeySalt,\n        contractId,\n        nearRpcUrl,\n        credential: serializedCredential,\n      });\n\t    } catch (err) {\n\t      console.error('[SigningFlow] WrapKeySeed derivation failed:', err);\n\t      throw err; // Don't silently ignore - propagate the error\n\t    }\n\n    // 6) Respond; keep nonces reserved for worker to use\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      credential: serializedCredential,\n      // prfOutput intentionally omitted to keep signer PRF-free\n      // WrapKeySeed travels only over the dedicated VRF→Signer MessagePort; do not echo in the main-thread envelope\n      vrfChallenge: uiVrfChallenge,\n      transactionContext,\n    });\n  } catch (err: unknown) {\n    // Treat TouchID/FaceID cancellation and related errors as a negative decision\n    const cancelled = isUserCancelledSecureConfirm(err);\n    // For missing PRF outputs, surface the error to caller (defensive path tests expect a throw)\n    const msg = String((toError(err))?.message || err || '');\n    if (/Missing PRF result/i.test(msg) || /Missing PRF results/i.test(msg)) {\n      // Ensure UI is closed and nonces released, then rethrow\n      return session.cleanupAndRethrow(err);\n    }\n    if (cancelled) {\n      window.parent?.postMessage({ type: 'WALLET_UI_CLOSED' }, '*');\n    }\n    const isWrongPasskeyError = /multiple passkeys \\(devicenumbers\\) for account/i.test(msg);\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: cancelled\n        ? ERROR_MESSAGES.cancelled\n        : (isWrongPasskeyError ? msg : (msg || ERROR_MESSAGES.collectCredentialsFailed)),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAyBA,SAAS,mBAAmB,SAAuD;AACjF,KAAI,QAAQ,SAAS,uBAAuB,iBAC1C,QAAO,0BAA0B,SAAS,mBAAmB;AAE/D,KAAI,QAAQ,SAAS,uBAAuB,oBAC1C,QAAO,QAAQ,QAAQ,mBAAmB;AAE5C,QAAO;;AAGT,eAAsB,6BACpB,KACA,SACA,QACA,MACe;CACf,MAAM,EAAE,oBAAoB,uBAAuB;CACnD,MAAM,WAAW,4BAA4B;CAC7C,MAAM,UAAU,qBAAqB;EACnC;EACA;EACA;EACA;EACA;;CAEF,MAAM,gBAAgB,iBAAiB;CACvC,MAAM,kBAAkB,mBAAmB;CAC3C,MAAM,aAAa,WAAW;CAC9B,MAAM,sBAAsB,QAAQ,SAAS,uBAAuB,mBAChE,gBAAgB,WAChB,QAAQ,SAAS,uBAAuB,sBACtC,MAAM,gCAAgC;EACtC;EACA,WAAW,QAAQ,QAAQ;EAC3B,SAAS,QAAQ,QAAQ;MAEzB;CACN,MAAM,wBAAwB,QAAQ,QAAQ;CAG9C,MAAM,UAAU,MAAM,SAAS,KAAK,iBAAiB;EAAE;EAAe,SAAS;EAAY,eAAe;;AAC1G,KAAI,CAAC,QAAQ,oBAAoB;AAE/B,UAAQ,MAAM,yCAAyC;GAAE,OAAO,QAAQ;GAAO,SAAS,QAAQ;;AAChG,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,QAAQ,UAAU,GAAG,eAAe,cAAc,IAAI,QAAQ,YAAY,eAAe;;;AAGpG,SAAQ,kBAAkB,QAAQ;CAClC,IAAIA,qBAAyC,QAAQ;CAKrD,MAAM,OAAO,SAAS,IAAI;CAC1B,IAAIC;CACJ,IAAIC,sBAAyD,OACzD;EACE,QAAQ;EACR;EACA,aAAa,mBAAmB;EAChC,WAAW,mBAAmB;KAEhC;AAGJ,KAAI,oBAAoB,YAAY;AAClC,mBAAiB,MAAM,SAAS,IAAI,+BAClC;GACE,QAAQ;GACR;GACA,aAAa,mBAAmB;GAChC,WAAW,mBAAmB;GAC9B,GAAI,sBAAsB,EAAE,cAAc,wBAAwB;GAClE,GAAI,wBAAwB,EAAE,0BAA0B;KAE1D,QAAQ;AAEV,wBAAsB;;CAIxB,MAAM,EAAE,WAAW,OAAO,YAAY,MAAM,QAAQ,WAAW,EAAE,cAAc;AAC/E,KAAI,CAAC,UACH,QAAO,QAAQ,qBAAqB;EAClC,WAAW,QAAQ;EACnB,cAAc,gBAAgB;EAC9B,WAAW;EACX,OAAO;;AAKX,KAAI,oBAAoB,eAAe;AACrC,MAAI;AACF,SAAM,SAAS,IAAI,mBAAmB;IAAE,WAAW,QAAQ;IAAW,MAAM;;WACrEC,KAAc;GACrB,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AACrD,UAAO,QAAQ,qBAAqB;IAClC,WAAW,QAAQ;IACnB,cAAc,gBAAgB;IAC9B,WAAW;IACX,OAAO,OAAO;;;AAIlB,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX;;AAEF;;AAIF,KAAI;EACF,MAAM,YAAY,MAAM,SAAS,IAAI,yBAAyB,SAAS;AACvE,mBAAiB,UAAU;AAC3B,uBAAqB,UAAU;AAC/B,UAAQ,SAAS,EAAE,cAAc;UAC1B,GAAG;AACV,UAAQ,MAAM,yCAAyC;;AAIzD,KAAI;AACF,MAAI,CAAC,eACH,OAAM,IAAI,MAAM;EAElB,MAAM,uBAAuB,MAAM,SAAS,SAAS,uCAAuC;GAC1F;GACA,cAAc;;EAKhB,IAAIC;EACJ,IAAIC;AACJ,MAAI;GAEF,MAAM,YAAY,MAAM,SAAS,IAAI;AACrC,OAAI,CAAC,UAAU,OACb,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,UAAU,iBAAiB,OAAO,UAAU,mBAAmB,OAAO,YAAY,gBACrF,OAAM,IAAI,MAAM;GAGlB,MAAM,eAAe,MAAM,4BAA4B,YAAY,gBAAgB,IAAI,UAAU;GACjG,MAAM,cAAc,MAAM,IAAI,UAAU,WAAW,oBAAoB,eAAe;AACtF,OAAI,CAAC,YACH,OAAM,IAAI,MAAM,qCAAqC,cAAc,UAAU;GAE/E,MAAM,cAAc,YAAY;AAChC,OAAI,CAAC,YACH,OAAM,IAAI,MAAM;AAMlB,OAAI,QAAQ,SAAS,uBAAuB,kBAAkB;IAC5D,MAAM,UAAU,0BAA0B;AAC1C,iBAAa,SAAS,SAAS;AAC/B,iBAAa,SAAS,SAAS;cACtB,QAAQ,SAAS,uBAAuB,qBAAqB;IACtE,MAAM,UAAU,QAAQ;AACxB,iBAAa,QAAQ,cAAc,gCAAgC;AACnE,iBAAa,QAAQ,cAAc,gCAAgC;;AAGrE,SAAM,SAAS,IAAI,+BAA+B;IAChD,WAAW,QAAQ;IACnB;IACA;IACA;IACA,YAAY;;WAEN,KAAK;AACZ,WAAQ,MAAM,gDAAgD;AAC9D,SAAM;;AAIT,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,YAAY;GAGZ,cAAc;GACd;;UAEKF,KAAc;EAErB,MAAM,YAAY,6BAA6B;EAE/C,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AACrD,MAAI,sBAAsB,KAAK,QAAQ,uBAAuB,KAAK,KAEjE,QAAO,QAAQ,kBAAkB;AAEnC,MAAI,UACF,QAAO,QAAQ,YAAY,EAAE,MAAM,sBAAsB;EAE3D,MAAM,sBAAsB,mDAAmD,KAAK;AACpF,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,YACH,eAAe,YACd,sBAAsB,MAAO,OAAO,eAAe"}
+{"version":3,"file":"transactions.js","names":["transactionContext: TransactionContext","uiVrfChallenge: VRFChallenge | undefined","uiVrfChallengeForUi: Partial<VRFChallenge> | undefined","err: unknown","contractId: string | undefined","nearRpcUrl: string | undefined"],"sources":["../../../../../../../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/transactions.ts"],"sourcesContent":["import type { VrfWorkerManagerContext } from '../../';\nimport type { ConfirmationConfig } from '../../../../types/signer-worker';\nimport {\n  SecureConfirmationType,\n  TransactionSummary,\n  SigningSecureConfirmRequest,\n  SigningAuthMode,\n} from '../types';\nimport { VRFChallenge, TransactionContext } from '../../../../types';\nimport {\n  getNearAccountId,\n  getIntentDigest,\n  getTxCount,\n  isUserCancelledSecureConfirm,\n  ERROR_MESSAGES,\n  getSignTransactionPayload,\n} from './index';\nimport { toAccountId } from '../../../../types/accountIds';\nimport { getLastLoggedInDeviceNumber } from '../../../SignerWorkerManager/getDeviceNumber';\nimport { toError } from '../../../../../utils/errors';\nimport { PASSKEY_MANAGER_DEFAULT_CONFIGS } from '../../../../defaultConfigs';\nimport { createConfirmSession } from '../adapters/session';\nimport { createConfirmTxFlowAdapters } from '../adapters/createAdapters';\nimport { computeUiIntentDigestFromNep413 } from '../../../../digests/intentDigest';\n\nfunction getSigningAuthMode(request: SigningSecureConfirmRequest): SigningAuthMode {\n  if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {\n    return getSignTransactionPayload(request).signingAuthMode ?? 'webauthn';\n  }\n  if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) {\n    return request.payload.signingAuthMode ?? 'webauthn';\n  }\n  return 'webauthn';\n}\n\nexport async function handleTransactionSigningFlow(\n  ctx: VrfWorkerManagerContext,\n  request: SigningSecureConfirmRequest,\n  worker: Worker,\n  opts: { confirmationConfig: ConfirmationConfig; transactionSummary: TransactionSummary },\n): Promise<void> {\n  const { confirmationConfig, transactionSummary } = opts;\n  const adapters = createConfirmTxFlowAdapters(ctx);\n  const session = createConfirmSession({\n    adapters,\n    worker,\n    request,\n    confirmationConfig,\n    transactionSummary,\n  });\n  const nearAccountId = getNearAccountId(request);\n  try {\n    const signingAuthMode = getSigningAuthMode(request);\n    const usesNeeded = getTxCount(request);\n    const vrfIntentDigestB64u = request.type === SecureConfirmationType.SIGN_TRANSACTION\n      ? getIntentDigest(request)\n      : request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE\n        ? await computeUiIntentDigestFromNep413({\n          nearAccountId,\n          recipient: request.payload.recipient,\n          message: request.payload.message,\n        })\n        : undefined;\n    const sessionPolicyDigest32 = request.payload.sessionPolicyDigest32;\n\n    // 1) NEAR context + nonce reservation\n    const nearRpc = await adapters.near.fetchNearContext({ nearAccountId, txCount: usesNeeded, reserveNonces: true });\n    if (!nearRpc.transactionContext) {\n      // eslint-disable-next-line no-console\n      console.error('[SigningFlow] fetchNearContext failed', { error: nearRpc.error, details: nearRpc.details });\n      return session.confirmAndCloseModal({\n        requestId: request.requestId,\n        intentDigest: getIntentDigest(request),\n        confirmed: false,\n        error: nearRpc.details ? `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}` : ERROR_MESSAGES.nearRpcFailed,\n      });\n    }\n    session.setReservedNonces(nearRpc.reservedNonces);\n    let transactionContext: TransactionContext = nearRpc.transactionContext;\n\n    // 2) Security context shown in the confirmer (rpId + block height).\n    // For warmSession signing we still want to show this context even though\n    // we won't collect a WebAuthn credential.\n    const rpId = adapters.vrf.getRpId();\n    let uiVrfChallenge: VRFChallenge | undefined;\n    let uiVrfChallengeForUi: Partial<VRFChallenge> | undefined = rpId\n      ? {\n          userId: nearAccountId,\n          rpId,\n          blockHeight: transactionContext.txBlockHeight,\n          blockHash: transactionContext.txBlockHash,\n        }\n      : undefined;\n\n    // Initial VRF challenge (only needed for WebAuthn credential collection)\n    if (signingAuthMode === 'webauthn') {\n      uiVrfChallenge = await adapters.vrf.generateVrfChallengeForSession(\n        {\n          userId: nearAccountId,\n          rpId,\n          blockHeight: transactionContext.txBlockHeight,\n          blockHash: transactionContext.txBlockHash,\n          ...(vrfIntentDigestB64u ? { intentDigest: vrfIntentDigestB64u } : {}),\n          ...(sessionPolicyDigest32 ? { sessionPolicyDigest32 } : {}),\n        },\n        request.requestId,\n      );\n      uiVrfChallengeForUi = uiVrfChallenge;\n    }\n\n    // 3) UI confirm\n    const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallengeForUi });\n    if (!confirmed) {\n      return session.confirmAndCloseModal({\n        requestId: request.requestId,\n        intentDigest: getIntentDigest(request),\n        confirmed: false,\n        error: uiError,\n      });\n    }\n\n    // 4) Warm session: dispense WrapKeySeed and skip WebAuthn\n    if (signingAuthMode === 'warmSession') {\n      try {\n        await adapters.vrf.dispenseSessionKey({ sessionId: request.requestId, uses: usesNeeded });\n      } catch (err: unknown) {\n        const msg = String((toError(err))?.message || err || '');\n        return session.confirmAndCloseModal({\n          requestId: request.requestId,\n          intentDigest: getIntentDigest(request),\n          confirmed: false,\n          error: msg || 'Failed to dispense warm session key',\n        });\n      }\n\n      session.confirmAndCloseModal({\n        requestId: request.requestId,\n        intentDigest: getIntentDigest(request),\n        confirmed: true,\n        transactionContext,\n      });\n      return;\n    }\n\n    // 5) JIT refresh VRF + ctx (best-effort)\n    try {\n      const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);\n      uiVrfChallenge = refreshed.vrfChallenge;\n      transactionContext = refreshed.transactionContext;\n      session.updateUI({ vrfChallenge: uiVrfChallenge });\n    } catch (e) {\n      console.debug('[SigningFlow] VRF JIT refresh skipped', e);\n    }\n\n    // 6) Collect authentication credential\n    if (!uiVrfChallenge) {\n      throw new Error('Missing vrfChallenge for WebAuthn signing flow');\n    }\n    const serializedCredential = await adapters.webauthn.collectAuthenticationCredentialWithPRF({\n      nearAccountId,\n      vrfChallenge: uiVrfChallenge,\n    });\n\n    // 5c) Derive WrapKeySeed inside the VRF worker and deliver it to the signer worker via\n    // the reserved WrapKeySeed MessagePort. Main thread only sees wrapKeySalt metadata.\n    let contractId: string | undefined;\n    let nearRpcUrl: string | undefined;\n    try {\n      // Ensure VRF session is active and bound to the same account we are signing for.\n      const vrfStatus = await adapters.vrf.checkVrfStatus();\n      if (!vrfStatus.active) {\n        throw new Error('VRF keypair not active in memory. VRF session may have expired or was not properly initialized. Please refresh and try again.');\n      }\n      if (!vrfStatus.nearAccountId || String(vrfStatus.nearAccountId) !== String(toAccountId(nearAccountId))) {\n        throw new Error('VRF session is active but bound to a different account than the one being signed. Please log in again on this device.');\n      }\n\n      const deviceNumber = await getLastLoggedInDeviceNumber(toAccountId(nearAccountId), ctx.indexedDB.clientDB);\n      const keyMaterial = await ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber);\n      if (!keyMaterial) {\n        throw new Error(`No key material found for account ${nearAccountId} device ${deviceNumber}`);\n      }\n      const wrapKeySalt = keyMaterial.wrapKeySalt;\n      if (!wrapKeySalt) {\n        throw new Error('Missing wrapKeySalt in vault; re-register to upgrade vault format.');\n      }\n\n      // Extract contract verification context when available.\n      // - SIGN_TRANSACTION: use per-request rpcCall (already normalized by caller).\n      // - SIGN_NEP413_MESSAGE: allow per-request override; fall back to PASSKEY_MANAGER_DEFAULT_CONFIGS.\n      if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {\n        const payload = getSignTransactionPayload(request);\n        contractId = payload?.rpcCall?.contractId;\n        nearRpcUrl = payload?.rpcCall?.nearRpcUrl;\n      } else if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) {\n        const payload = request.payload;\n        contractId = payload.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId;\n        nearRpcUrl = payload.nearRpcUrl || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl;\n      }\n\n      await adapters.vrf.mintSessionKeysAndSendToSigner({\n        sessionId: request.requestId,\n        wrapKeySalt,\n        contractId,\n        nearRpcUrl,\n        credential: serializedCredential,\n      });\n\t    } catch (err) {\n\t      console.error('[SigningFlow] WrapKeySeed derivation failed:', err);\n\t      throw err; // Don't silently ignore - propagate the error\n\t    }\n\n    // 6) Respond; keep nonces reserved for worker to use\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      credential: serializedCredential,\n      // prfOutput intentionally omitted to keep signer PRF-free\n      // WrapKeySeed travels only over the dedicated VRF→Signer MessagePort; do not echo in the main-thread envelope\n      vrfChallenge: uiVrfChallenge,\n      transactionContext,\n    });\n  } catch (err: unknown) {\n    // Treat TouchID/FaceID cancellation and related errors as a negative decision\n    const cancelled = isUserCancelledSecureConfirm(err);\n    const msg = String((toError(err))?.message || err || '');\n    if (cancelled) {\n      window.parent?.postMessage({ type: 'WALLET_UI_CLOSED' }, '*');\n    }\n    const isWrongPasskeyError = /multiple passkeys \\(devicenumbers\\) for account/i.test(msg);\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: cancelled\n        ? ERROR_MESSAGES.cancelled\n        : (isWrongPasskeyError ? msg : (msg || ERROR_MESSAGES.collectCredentialsFailed)),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAyBA,SAAS,mBAAmB,SAAuD;AACjF,KAAI,QAAQ,SAAS,uBAAuB,iBAC1C,QAAO,0BAA0B,SAAS,mBAAmB;AAE/D,KAAI,QAAQ,SAAS,uBAAuB,oBAC1C,QAAO,QAAQ,QAAQ,mBAAmB;AAE5C,QAAO;;AAGT,eAAsB,6BACpB,KACA,SACA,QACA,MACe;CACf,MAAM,EAAE,oBAAoB,uBAAuB;CACnD,MAAM,WAAW,4BAA4B;CAC7C,MAAM,UAAU,qBAAqB;EACnC;EACA;EACA;EACA;EACA;;CAEF,MAAM,gBAAgB,iBAAiB;AACvC,KAAI;EACF,MAAM,kBAAkB,mBAAmB;EAC3C,MAAM,aAAa,WAAW;EAC9B,MAAM,sBAAsB,QAAQ,SAAS,uBAAuB,mBAChE,gBAAgB,WAChB,QAAQ,SAAS,uBAAuB,sBACtC,MAAM,gCAAgC;GACtC;GACA,WAAW,QAAQ,QAAQ;GAC3B,SAAS,QAAQ,QAAQ;OAEzB;EACN,MAAM,wBAAwB,QAAQ,QAAQ;EAG9C,MAAM,UAAU,MAAM,SAAS,KAAK,iBAAiB;GAAE;GAAe,SAAS;GAAY,eAAe;;AAC1G,MAAI,CAAC,QAAQ,oBAAoB;AAE/B,WAAQ,MAAM,yCAAyC;IAAE,OAAO,QAAQ;IAAO,SAAS,QAAQ;;AAChG,UAAO,QAAQ,qBAAqB;IAClC,WAAW,QAAQ;IACnB,cAAc,gBAAgB;IAC9B,WAAW;IACX,OAAO,QAAQ,UAAU,GAAG,eAAe,cAAc,IAAI,QAAQ,YAAY,eAAe;;;AAGpG,UAAQ,kBAAkB,QAAQ;EAClC,IAAIA,qBAAyC,QAAQ;EAKrD,MAAM,OAAO,SAAS,IAAI;EAC1B,IAAIC;EACJ,IAAIC,sBAAyD,OACzD;GACE,QAAQ;GACR;GACA,aAAa,mBAAmB;GAChC,WAAW,mBAAmB;MAEhC;AAGJ,MAAI,oBAAoB,YAAY;AAClC,oBAAiB,MAAM,SAAS,IAAI,+BAClC;IACE,QAAQ;IACR;IACA,aAAa,mBAAmB;IAChC,WAAW,mBAAmB;IAC9B,GAAI,sBAAsB,EAAE,cAAc,wBAAwB;IAClE,GAAI,wBAAwB,EAAE,0BAA0B;MAE1D,QAAQ;AAEV,yBAAsB;;EAIxB,MAAM,EAAE,WAAW,OAAO,YAAY,MAAM,QAAQ,WAAW,EAAE,cAAc;AAC/E,MAAI,CAAC,UACH,QAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO;;AAKX,MAAI,oBAAoB,eAAe;AACrC,OAAI;AACF,UAAM,SAAS,IAAI,mBAAmB;KAAE,WAAW,QAAQ;KAAW,MAAM;;YACrEC,KAAc;IACrB,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AACrD,WAAO,QAAQ,qBAAqB;KAClC,WAAW,QAAQ;KACnB,cAAc,gBAAgB;KAC9B,WAAW;KACX,OAAO,OAAO;;;AAIlB,WAAQ,qBAAqB;IAC3B,WAAW,QAAQ;IACnB,cAAc,gBAAgB;IAC9B,WAAW;IACX;;AAEF;;AAIF,MAAI;GACF,MAAM,YAAY,MAAM,SAAS,IAAI,yBAAyB,SAAS;AACvE,oBAAiB,UAAU;AAC3B,wBAAqB,UAAU;AAC/B,WAAQ,SAAS,EAAE,cAAc;WAC1B,GAAG;AACV,WAAQ,MAAM,yCAAyC;;AAIzD,MAAI,CAAC,eACH,OAAM,IAAI,MAAM;EAElB,MAAM,uBAAuB,MAAM,SAAS,SAAS,uCAAuC;GAC1F;GACA,cAAc;;EAKhB,IAAIC;EACJ,IAAIC;AACJ,MAAI;GAEF,MAAM,YAAY,MAAM,SAAS,IAAI;AACrC,OAAI,CAAC,UAAU,OACb,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,UAAU,iBAAiB,OAAO,UAAU,mBAAmB,OAAO,YAAY,gBACrF,OAAM,IAAI,MAAM;GAGlB,MAAM,eAAe,MAAM,4BAA4B,YAAY,gBAAgB,IAAI,UAAU;GACjG,MAAM,cAAc,MAAM,IAAI,UAAU,WAAW,oBAAoB,eAAe;AACtF,OAAI,CAAC,YACH,OAAM,IAAI,MAAM,qCAAqC,cAAc,UAAU;GAE/E,MAAM,cAAc,YAAY;AAChC,OAAI,CAAC,YACH,OAAM,IAAI,MAAM;AAMlB,OAAI,QAAQ,SAAS,uBAAuB,kBAAkB;IAC5D,MAAM,UAAU,0BAA0B;AAC1C,iBAAa,SAAS,SAAS;AAC/B,iBAAa,SAAS,SAAS;cACtB,QAAQ,SAAS,uBAAuB,qBAAqB;IACtE,MAAM,UAAU,QAAQ;AACxB,iBAAa,QAAQ,cAAc,gCAAgC;AACnE,iBAAa,QAAQ,cAAc,gCAAgC;;AAGrE,SAAM,SAAS,IAAI,+BAA+B;IAChD,WAAW,QAAQ;IACnB;IACA;IACA;IACA,YAAY;;WAEN,KAAK;AACZ,WAAQ,MAAM,gDAAgD;AAC9D,SAAM;;AAIT,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,YAAY;GAGZ,cAAc;GACd;;UAEKF,KAAc;EAErB,MAAM,YAAY,6BAA6B;EAC/C,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AACrD,MAAI,UACF,QAAO,QAAQ,YAAY,EAAE,MAAM,sBAAsB;EAE3D,MAAM,sBAAsB,mDAAmD,KAAK;AACpF,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,YACH,eAAe,YACd,sBAAsB,MAAO,OAAO,eAAe"}

package/dist/esm/react/src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/handleSecureConfirmRequest.js

@@ -51,13 +51,23 @@ async function handlePromptUserConfirmInJsMainThread(ctx, message, worker) {
 		});
 		return;
 	}
-	await handler({
-		ctx,
-		request,
-		worker,
-		confirmationConfig,
-		transactionSummary
-	});
+	try {
+		await handler({
+			ctx,
+			request,
+			worker,
+			confirmationConfig,
+			transactionSummary
+		});
+	} catch (e) {
+		console.error("[SecureConfirm][Host] handler failed", e);
+		sendConfirmResponse(worker, {
+			requestId: request.requestId,
+			intentDigest: getIntentDigest(request),
+			confirmed: false,
+			error: errorMessage(e) || "Secure confirmation failed"
+		});
+	}
 }
 async function importFlow(label, loader) {
 	try {

package/dist/esm/react/src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/handleSecureConfirmRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"handleSecureConfirmRequest.js","names":["request: SecureConfirmRequest","confirmationConfig: ConfirmationConfig","transactionSummary: TransactionSummary","e: unknown","_err: unknown","HANDLERS: Partial<Record<SecureConfirmationType, Handler>>"],"sources":["../../../../../../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/handleSecureConfirmRequest.ts"],"sourcesContent":["import type { VrfWorkerManagerContext } from '../';\nimport type { ConfirmationConfig } from '../../../types/signer-worker';\nimport { determineConfirmationConfig } from './determineConfirmationConfig';\nimport {\n  TransactionSummary,\n  SecureConfirmMessageType,\n  SecureConfirmRequest,\n  SecureConfirmationType,\n} from './types';\nimport { errorMessage, toError } from '../../../../utils/errors';\nimport {\n  parseTransactionSummary,\n  getIntentDigest,\n  sendConfirmResponse,\n  sanitizeForPostMessage,\n} from './flows';\nimport {\n  assertNoForbiddenMainThreadSigningSecrets,\n  validateSecureConfirmRequest,\n} from './adapters/requestAdapter';\nimport type {\n  LocalOnlySecureConfirmRequest,\n  RegistrationSecureConfirmRequest,\n  SigningSecureConfirmRequest,\n} from './types';\n\n/**\n * Handles secure confirmation requests from the worker with robust error handling\n * => SecureConfirmMessageType.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD\n * and proper data validation. Supports both transaction and registration confirmation flows.\n */\nexport async function handlePromptUserConfirmInJsMainThread(\n  ctx: VrfWorkerManagerContext,\n  message: {\n    type: SecureConfirmMessageType.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD,\n    data: SecureConfirmRequest,\n  },\n  worker: Worker\n): Promise<void> {\n\n  // 1. Validate and parse request\n  let request: SecureConfirmRequest;\n  let confirmationConfig: ConfirmationConfig;\n  let transactionSummary: TransactionSummary;\n\n  try {\n\n    request = validateSecureConfirmRequest(message.data);\n    assertNoForbiddenMainThreadSigningSecrets(request);\n    confirmationConfig = determineConfirmationConfig(ctx, request);\n\n    const parsedSummary = parseTransactionSummary(request.summary);\n    const intentDigest = getIntentDigest(request);\n\n    transactionSummary = sanitizeForPostMessage({\n      ...parsedSummary,\n      ...(intentDigest ? { intentDigest } : {}),\n    }) as TransactionSummary;\n\n  } catch (e: unknown) {\n\n    console.error('[SecureConfirm][Host] validateAndParseRequest failed', e);\n    // Attempt to send a structured error back to the worker to avoid hard failure\n    try {\n      const rid = (message?.data as any)?.requestId;\n      if (typeof rid === 'string' && rid) {\n        sendConfirmResponse(worker, {\n          requestId: rid,\n          confirmed: false,\n          error: errorMessage(e) || 'Invalid secure confirm request',\n        });\n        return;\n      }\n    } catch (_err: unknown) {\n      throw toError(e);\n    }\n    throw toError(e);\n  }\n\n  const handler = HANDLERS[request.type];\n  if (!handler) {\n    // Unsupported type fallback: return structured error to worker.\n    sendConfirmResponse(worker, {\n      requestId: request.requestId,\n      confirmed: false,\n      error: 'Unsupported secure confirmation type'\n    });\n    return;\n  }\n\n  await handler({ ctx, request, worker, confirmationConfig, transactionSummary });\n}\n\ntype HandlerArgs = {\n  ctx: VrfWorkerManagerContext;\n  request: SecureConfirmRequest;\n  worker: Worker;\n  confirmationConfig: ConfirmationConfig;\n  transactionSummary: TransactionSummary;\n};\n\ntype Handler = (args: HandlerArgs) => Promise<void>;\n\nasync function importFlow<T>(label: string, loader: () => Promise<T>): Promise<T> {\n  try {\n    return await loader();\n  } catch (e) {\n    console.error(`[SecureConfirm][Host] failed to import ${label} flow module`, e);\n    throw e;\n  }\n}\n\nconst HANDLERS: Partial<Record<SecureConfirmationType, Handler>> = {\n  [SecureConfirmationType.DECRYPT_PRIVATE_KEY_WITH_PRF]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {\n    const { handleLocalOnlyFlow } = await importFlow('localOnly', () => import('./flows/localOnly'));\n    await handleLocalOnlyFlow(ctx, request as LocalOnlySecureConfirmRequest, worker, { confirmationConfig, transactionSummary });\n  },\n  [SecureConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {\n    const { handleLocalOnlyFlow } = await importFlow('localOnly', () => import('./flows/localOnly'));\n    await handleLocalOnlyFlow(ctx, request as LocalOnlySecureConfirmRequest, worker, { confirmationConfig, transactionSummary });\n  },\n  [SecureConfirmationType.REGISTER_ACCOUNT]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {\n    const { handleRegistrationFlow } = await importFlow('registration', () => import('./flows/registration'));\n    await handleRegistrationFlow(ctx, request as RegistrationSecureConfirmRequest, worker, { confirmationConfig, transactionSummary });\n  },\n  [SecureConfirmationType.LINK_DEVICE]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {\n    const { handleRegistrationFlow } = await importFlow('registration', () => import('./flows/registration'));\n    await handleRegistrationFlow(ctx, request as RegistrationSecureConfirmRequest, worker, { confirmationConfig, transactionSummary });\n  },\n  [SecureConfirmationType.SIGN_TRANSACTION]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {\n    const { handleTransactionSigningFlow } = await importFlow('transactions', () => import('./flows/transactions'));\n    await handleTransactionSigningFlow(ctx, request as SigningSecureConfirmRequest, worker, { confirmationConfig, transactionSummary });\n  },\n  [SecureConfirmationType.SIGN_NEP413_MESSAGE]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {\n    const { handleTransactionSigningFlow } = await importFlow('transactions', () => import('./flows/transactions'));\n    await handleTransactionSigningFlow(ctx, request as SigningSecureConfirmRequest, worker, { confirmationConfig, transactionSummary });\n  },\n};\n"],"mappings":";;;;;;;;;;;;;AA+BA,eAAsB,sCACpB,KACA,SAIA,QACe;CAGf,IAAIA;CACJ,IAAIC;CACJ,IAAIC;AAEJ,KAAI;AAEF,YAAU,6BAA6B,QAAQ;AAC/C,4CAA0C;AAC1C,uBAAqB,4BAA4B,KAAK;EAEtD,MAAM,gBAAgB,wBAAwB,QAAQ;EACtD,MAAM,eAAe,gBAAgB;AAErC,uBAAqB,uBAAuB;GAC1C,GAAG;GACH,GAAI,eAAe,EAAE,iBAAiB;;UAGjCC,GAAY;AAEnB,UAAQ,MAAM,wDAAwD;AAEtE,MAAI;GACF,MAAM,OAAO,SAAS,OAAc;AACpC,OAAI,OAAO,QAAQ,YAAY,KAAK;AAClC,wBAAoB,QAAQ;KAC1B,WAAW;KACX,WAAW;KACX,OAAO,aAAa,MAAM;;AAE5B;;WAEKC,MAAe;AACtB,SAAM,QAAQ;;AAEhB,QAAM,QAAQ;;CAGhB,MAAM,UAAU,SAAS,QAAQ;AACjC,KAAI,CAAC,SAAS;AAEZ,sBAAoB,QAAQ;GAC1B,WAAW,QAAQ;GACnB,WAAW;GACX,OAAO;;AAET;;AAGF,OAAM,QAAQ;EAAE;EAAK;EAAS;EAAQ;EAAoB;;;AAa5D,eAAe,WAAc,OAAe,QAAsC;AAChF,KAAI;AACF,SAAO,MAAM;UACN,GAAG;AACV,UAAQ,MAAM,0CAA0C,MAAM,eAAe;AAC7E,QAAM;;;AAIV,MAAMC,WAA6D;EAChE,uBAAuB,+BAA+B,OAAO,EAAE,KAAK,SAAS,QAAQ,oBAAoB,yBAAyB;EACjI,MAAM,EAAE,wBAAwB,MAAM,WAAW,mBAAmB,OAAO;AAC3E,QAAM,oBAAoB,KAAK,SAA0C,QAAQ;GAAE;GAAoB;;;EAExG,uBAAuB,6BAA6B,OAAO,EAAE,KAAK,SAAS,QAAQ,oBAAoB,yBAAyB;EAC/H,MAAM,EAAE,wBAAwB,MAAM,WAAW,mBAAmB,OAAO;AAC3E,QAAM,oBAAoB,KAAK,SAA0C,QAAQ;GAAE;GAAoB;;;EAExG,uBAAuB,mBAAmB,OAAO,EAAE,KAAK,SAAS,QAAQ,oBAAoB,yBAAyB;EACrH,MAAM,EAAE,2BAA2B,MAAM,WAAW,sBAAsB,OAAO;AACjF,QAAM,uBAAuB,KAAK,SAA6C,QAAQ;GAAE;GAAoB;;;EAE9G,uBAAuB,cAAc,OAAO,EAAE,KAAK,SAAS,QAAQ,oBAAoB,yBAAyB;EAChH,MAAM,EAAE,2BAA2B,MAAM,WAAW,sBAAsB,OAAO;AACjF,QAAM,uBAAuB,KAAK,SAA6C,QAAQ;GAAE;GAAoB;;;EAE9G,uBAAuB,mBAAmB,OAAO,EAAE,KAAK,SAAS,QAAQ,oBAAoB,yBAAyB;EACrH,MAAM,EAAE,iCAAiC,MAAM,WAAW,sBAAsB,OAAO;AACvF,QAAM,6BAA6B,KAAK,SAAwC,QAAQ;GAAE;GAAoB;;;EAE/G,uBAAuB,sBAAsB,OAAO,EAAE,KAAK,SAAS,QAAQ,oBAAoB,yBAAyB;EACxH,MAAM,EAAE,iCAAiC,MAAM,WAAW,sBAAsB,OAAO;AACvF,QAAM,6BAA6B,KAAK,SAAwC,QAAQ;GAAE;GAAoB"}
+{"version":3,"file":"handleSecureConfirmRequest.js","names":["request: SecureConfirmRequest","confirmationConfig: ConfirmationConfig","transactionSummary: TransactionSummary","e: unknown","_err: unknown","HANDLERS: Partial<Record<SecureConfirmationType, Handler>>"],"sources":["../../../../../../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/handleSecureConfirmRequest.ts"],"sourcesContent":["import type { VrfWorkerManagerContext } from '../';\nimport type { ConfirmationConfig } from '../../../types/signer-worker';\nimport { determineConfirmationConfig } from './determineConfirmationConfig';\nimport {\n  TransactionSummary,\n  SecureConfirmMessageType,\n  SecureConfirmRequest,\n  SecureConfirmationType,\n} from './types';\nimport { errorMessage, toError } from '../../../../utils/errors';\nimport {\n  parseTransactionSummary,\n  getIntentDigest,\n  sendConfirmResponse,\n  sanitizeForPostMessage,\n} from './flows';\nimport {\n  assertNoForbiddenMainThreadSigningSecrets,\n  validateSecureConfirmRequest,\n} from './adapters/requestAdapter';\nimport type {\n  LocalOnlySecureConfirmRequest,\n  RegistrationSecureConfirmRequest,\n  SigningSecureConfirmRequest,\n} from './types';\n\n/**\n * Handles secure confirmation requests from the worker with robust error handling\n * => SecureConfirmMessageType.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD\n * and proper data validation. Supports both transaction and registration confirmation flows.\n */\nexport async function handlePromptUserConfirmInJsMainThread(\n  ctx: VrfWorkerManagerContext,\n  message: {\n    type: SecureConfirmMessageType.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD,\n    data: SecureConfirmRequest,\n  },\n  worker: Worker\n): Promise<void> {\n\n  // 1. Validate and parse request\n  let request: SecureConfirmRequest;\n  let confirmationConfig: ConfirmationConfig;\n  let transactionSummary: TransactionSummary;\n\n  try {\n\n    request = validateSecureConfirmRequest(message.data);\n    assertNoForbiddenMainThreadSigningSecrets(request);\n    confirmationConfig = determineConfirmationConfig(ctx, request);\n\n    const parsedSummary = parseTransactionSummary(request.summary);\n    const intentDigest = getIntentDigest(request);\n\n    transactionSummary = sanitizeForPostMessage({\n      ...parsedSummary,\n      ...(intentDigest ? { intentDigest } : {}),\n    }) as TransactionSummary;\n\n  } catch (e: unknown) {\n\n    console.error('[SecureConfirm][Host] validateAndParseRequest failed', e);\n    // Attempt to send a structured error back to the worker to avoid hard failure\n    try {\n      const rid = (message?.data as any)?.requestId;\n      if (typeof rid === 'string' && rid) {\n        sendConfirmResponse(worker, {\n          requestId: rid,\n          confirmed: false,\n          error: errorMessage(e) || 'Invalid secure confirm request',\n        });\n        return;\n      }\n    } catch (_err: unknown) {\n      throw toError(e);\n    }\n    throw toError(e);\n  }\n\n  const handler = HANDLERS[request.type];\n  if (!handler) {\n    // Unsupported type fallback: return structured error to worker.\n    sendConfirmResponse(worker, {\n      requestId: request.requestId,\n      confirmed: false,\n      error: 'Unsupported secure confirmation type'\n    });\n    return;\n  }\n\n  try {\n    await handler({ ctx, request, worker, confirmationConfig, transactionSummary });\n  } catch (e: unknown) {\n    console.error('[SecureConfirm][Host] handler failed', e);\n    // Best-effort: always respond to the worker so VRF-side requests don't hang indefinitely.\n    sendConfirmResponse(worker, {\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: errorMessage(e) || 'Secure confirmation failed',\n    });\n  }\n}\n\ntype HandlerArgs = {\n  ctx: VrfWorkerManagerContext;\n  request: SecureConfirmRequest;\n  worker: Worker;\n  confirmationConfig: ConfirmationConfig;\n  transactionSummary: TransactionSummary;\n};\n\ntype Handler = (args: HandlerArgs) => Promise<void>;\n\nasync function importFlow<T>(label: string, loader: () => Promise<T>): Promise<T> {\n  try {\n    return await loader();\n  } catch (e) {\n    console.error(`[SecureConfirm][Host] failed to import ${label} flow module`, e);\n    throw e;\n  }\n}\n\nconst HANDLERS: Partial<Record<SecureConfirmationType, Handler>> = {\n  [SecureConfirmationType.DECRYPT_PRIVATE_KEY_WITH_PRF]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {\n    const { handleLocalOnlyFlow } = await importFlow('localOnly', () => import('./flows/localOnly'));\n    await handleLocalOnlyFlow(ctx, request as LocalOnlySecureConfirmRequest, worker, { confirmationConfig, transactionSummary });\n  },\n  [SecureConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {\n    const { handleLocalOnlyFlow } = await importFlow('localOnly', () => import('./flows/localOnly'));\n    await handleLocalOnlyFlow(ctx, request as LocalOnlySecureConfirmRequest, worker, { confirmationConfig, transactionSummary });\n  },\n  [SecureConfirmationType.REGISTER_ACCOUNT]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {\n    const { handleRegistrationFlow } = await importFlow('registration', () => import('./flows/registration'));\n    await handleRegistrationFlow(ctx, request as RegistrationSecureConfirmRequest, worker, { confirmationConfig, transactionSummary });\n  },\n  [SecureConfirmationType.LINK_DEVICE]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {\n    const { handleRegistrationFlow } = await importFlow('registration', () => import('./flows/registration'));\n    await handleRegistrationFlow(ctx, request as RegistrationSecureConfirmRequest, worker, { confirmationConfig, transactionSummary });\n  },\n  [SecureConfirmationType.SIGN_TRANSACTION]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {\n    const { handleTransactionSigningFlow } = await importFlow('transactions', () => import('./flows/transactions'));\n    await handleTransactionSigningFlow(ctx, request as SigningSecureConfirmRequest, worker, { confirmationConfig, transactionSummary });\n  },\n  [SecureConfirmationType.SIGN_NEP413_MESSAGE]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {\n    const { handleTransactionSigningFlow } = await importFlow('transactions', () => import('./flows/transactions'));\n    await handleTransactionSigningFlow(ctx, request as SigningSecureConfirmRequest, worker, { confirmationConfig, transactionSummary });\n  },\n};\n"],"mappings":";;;;;;;;;;;;;AA+BA,eAAsB,sCACpB,KACA,SAIA,QACe;CAGf,IAAIA;CACJ,IAAIC;CACJ,IAAIC;AAEJ,KAAI;AAEF,YAAU,6BAA6B,QAAQ;AAC/C,4CAA0C;AAC1C,uBAAqB,4BAA4B,KAAK;EAEtD,MAAM,gBAAgB,wBAAwB,QAAQ;EACtD,MAAM,eAAe,gBAAgB;AAErC,uBAAqB,uBAAuB;GAC1C,GAAG;GACH,GAAI,eAAe,EAAE,iBAAiB;;UAGjCC,GAAY;AAEnB,UAAQ,MAAM,wDAAwD;AAEtE,MAAI;GACF,MAAM,OAAO,SAAS,OAAc;AACpC,OAAI,OAAO,QAAQ,YAAY,KAAK;AAClC,wBAAoB,QAAQ;KAC1B,WAAW;KACX,WAAW;KACX,OAAO,aAAa,MAAM;;AAE5B;;WAEKC,MAAe;AACtB,SAAM,QAAQ;;AAEhB,QAAM,QAAQ;;CAGhB,MAAM,UAAU,SAAS,QAAQ;AACjC,KAAI,CAAC,SAAS;AAEZ,sBAAoB,QAAQ;GAC1B,WAAW,QAAQ;GACnB,WAAW;GACX,OAAO;;AAET;;AAGF,KAAI;AACF,QAAM,QAAQ;GAAE;GAAK;GAAS;GAAQ;GAAoB;;UACnDD,GAAY;AACnB,UAAQ,MAAM,wCAAwC;AAEtD,sBAAoB,QAAQ;GAC1B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,aAAa,MAAM;;;;AAehC,eAAe,WAAc,OAAe,QAAsC;AAChF,KAAI;AACF,SAAO,MAAM;UACN,GAAG;AACV,UAAQ,MAAM,0CAA0C,MAAM,eAAe;AAC7E,QAAM;;;AAIV,MAAME,WAA6D;EAChE,uBAAuB,+BAA+B,OAAO,EAAE,KAAK,SAAS,QAAQ,oBAAoB,yBAAyB;EACjI,MAAM,EAAE,wBAAwB,MAAM,WAAW,mBAAmB,OAAO;AAC3E,QAAM,oBAAoB,KAAK,SAA0C,QAAQ;GAAE;GAAoB;;;EAExG,uBAAuB,6BAA6B,OAAO,EAAE,KAAK,SAAS,QAAQ,oBAAoB,yBAAyB;EAC/H,MAAM,EAAE,wBAAwB,MAAM,WAAW,mBAAmB,OAAO;AAC3E,QAAM,oBAAoB,KAAK,SAA0C,QAAQ;GAAE;GAAoB;;;EAExG,uBAAuB,mBAAmB,OAAO,EAAE,KAAK,SAAS,QAAQ,oBAAoB,yBAAyB;EACrH,MAAM,EAAE,2BAA2B,MAAM,WAAW,sBAAsB,OAAO;AACjF,QAAM,uBAAuB,KAAK,SAA6C,QAAQ;GAAE;GAAoB;;;EAE9G,uBAAuB,cAAc,OAAO,EAAE,KAAK,SAAS,QAAQ,oBAAoB,yBAAyB;EAChH,MAAM,EAAE,2BAA2B,MAAM,WAAW,sBAAsB,OAAO;AACjF,QAAM,uBAAuB,KAAK,SAA6C,QAAQ;GAAE;GAAoB;;;EAE9G,uBAAuB,mBAAmB,OAAO,EAAE,KAAK,SAAS,QAAQ,oBAAoB,yBAAyB;EACrH,MAAM,EAAE,iCAAiC,MAAM,WAAW,sBAAsB,OAAO;AACvF,QAAM,6BAA6B,KAAK,SAAwC,QAAQ;GAAE;GAAoB;;;EAE/G,uBAAuB,sBAAsB,OAAO,EAAE,KAAK,SAAS,QAAQ,oBAAoB,yBAAyB;EACxH,MAAM,EAAE,iCAAiC,MAAM,WAAW,sBAAsB,OAAO;AACvF,QAAM,6BAA6B,KAAK,SAAwC,QAAQ;GAAE;GAAoB"}

package/dist/esm/react/src/core/WebAuthnManager/index.js

@@ -447,13 +447,13 @@ var WebAuthnManager = class {
 	/**
 	* Persist refreshed server-encrypted VRF keypair in IndexedDB.
 	*/
-	async updateServerEncryptedVrfKeypair(nearAccountId, serverEncrypted) {
+	async updateServerEncryptedVrfKeypair(nearAccountId, serverEncrypted, deviceNumber) {
 		await IndexedDBManager.clientDB.updateUser(nearAccountId, { serverEncryptedVrfKeypair: {
 			ciphertextVrfB64u: serverEncrypted.ciphertextVrfB64u,
 			kek_s_b64u: serverEncrypted.kek_s_b64u,
 			serverKeyId: serverEncrypted.serverKeyId,
 			updatedAt: Date.now()
-		} });
+		} }, deviceNumber);
 	}
 	async clearVrfSession() {
 		if (typeof window !== "undefined" && this.workerBaseOrigin !== window.location.origin) return;
@@ -561,7 +561,7 @@ var WebAuthnManager = class {
 			const active = status.active && status.nearAccountId === nearAccountId;
 			if (!active) return false;
 			const refreshed = await this.shamir3PassEncryptCurrentVrfKeypair();
-			await this.updateServerEncryptedVrfKeypair(nearAccountId, refreshed);
+			await this.updateServerEncryptedVrfKeypair(nearAccountId, refreshed, userData?.deviceNumber);
 			return true;
 		} catch {
 			return false;